Server Load Balancing Overview

Server load balancing (SLB) is the process of deciding to which server a load-balancing device should send a client request for service. For example, a client request can consist of an HTTP GET for a Web page or an FTP GET to download a file. The job of the load balancer is to select the server that can successfully fulfill the client request and do so in the shortest amount of time without overloading either the server or the server farm as a whole.

Depending on the load-balancing algorithm or predictor that you configure, the ACE appliance performs a series of checks and calculations to determine the server that can best service each client request. The ACE appliance bases server selection on several factors, including the server with the fewest connections with respect to load, source or destination address, cookies, URLs, or HTTP headers.

Load-Balancing Predictors

The ACE appliance uses the following predictors to select the best server to satisfy a client request:

•Hash Address—Selects the server using a hash value based on either the source or destination IP address, or both. Use these predictors for firewall load balancing (FWLB).

Note FWLB allows you to scale firewall protection by distributing traffic across multiple firewalls on a per-connection basis. All packets belonging to a particular connection must go through the same firewall. The firewall then allows or denies transmission of individual packets across its interfaces. For more information about configuring FWLB on the ACE appliance, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide.

•Hash Content— Selects the server by using a hash value based on the specified content string of the HTTP packet body

•Hash Cookie—Selects the server using a hash value based on a cookie name.

•Hash Secondary Cookie—The ACE selects the server by using the hash value based on the specified cookie name in the URL query string, not the cookie header.

•Hash Header—Selects the server using a hash value based on the HTTP header name.

•Hash URL—Selects the server using a hash value based on the requested URL.You can specify a beginning pattern and an ending pattern to match in the URL. Use this predictor method to load-balance cache servers. Cache servers perform better with the URL hash method because you can divide the contents of the caches evenly if the traffic is random enough. In a redundant configuration, the cache servers continue to work even if the active ACE appliance switches over to the standby ACE appliance. For information about configuring redundancy, see Configuring High Availability, page 9-1.

•Least Bandwidth—Selects the server with the least amount of network traffic or a specified sampling period. Use this type for server farms with heavy traffic, such as downloading video clips.

•Least Connections—Selects the server with the fewest number of active connections based on server weight. For the least connection predictor, you can configure a slow-start mechanism to avoid sending a high rate of new connections to servers that you have just put into service.

•Least Loaded—Selects the server with the lowest load as determined by information from SNMP probes.

•Response—Selects the server with the lowest response time for a specific response-time measurement.

•Round Robin—Selects the next server in the list of real servers based on server weight (weighted roundrobin). Servers with a higher weight value receive a higher percentage of the connections. This is the default predictor.

Note The different hash predictor methods do not recognize the weight value that you configure for real servers. The ACE uses the weight that you assign to real servers only in the round-robin and least-connections predictor methods.

Real Servers

To provide services to clients, you configure real servers on the ACE appliance. Real servers are dedicated physical servers that you typically configure in groups called server farms. These servers provide client services such as HTTP or XML content, Web site hosting, FTP file uploads or downloads, redirection for Web pages that have moved to another location, and so on. You identify real servers with names and characterize them with IP addresses, connection limits, and weight values. The ACE appliance also allows you to configure backup servers in case a server is taken out of service for any reason.

After you create and name a real server on the ACE appliance, you can configure several parameters, including connection limits, health probes, and weight. You can assign a weight to each real server based on its relative importance to other servers in the server farm. The ACE appliance uses the server weight value for the weighted round-robin and the least-connections load-balancing predictors. The load-balancing predictor algorithms (for example, round-robin, least connections, and so on) determine the servers to which the ACE appliance sends connection requests. For a listing and brief description of the load-balancing predictors, see Load-Balancing Predictors.

The ACE appliance uses traffic classification maps (class maps) within policy maps to filter out interesting traffic and to apply specific actions to that traffic based on the SLB configuration. You use class maps to configure a virtual server address and definition.

If a primary real server fails, the ACE appliance takes that server out of service and no longer includes it in load-balancing decisions. If you configured a backup server for the real server that failed, the ACE appliance redirects the primary real server connections to the backup server. For information about configuring a backup server, see the Configuring Virtual Server Layer 7 Load Balancing, page 3-26.

The ACE appliance can take a real server out of service for the following reasons:

•Probe failure

•ARP timeout

•Specifying Out Of Service as the administrative state of a real server

•Specifying In Service Standby as the administrative state of a real server

The Out Of Service and In Service Standby selections both provide the graceful shutdown of a server.

Server Farms

Typically, in data centers, servers are organized into related groups called server farms. Servers within server farms often contain identical content (referred to as mirrored content) so that if one server becomes inoperative, another server can take its place immediately. Also, having mirrored content allows several servers to share the load of increased demand during important local or international events, such as the Olympic Games. This phenomenon of a sudden large demand for content is called a flash crowd.

After you create and name a server farm, you can add existing real servers to it and configure other server farm parameters, such as the load-balancing predictor, server weight, backup server, health probe, and so on. For a listing and brief description of load-balancing predictors, see Load-Balancing Predictors.

Configuring Real Servers

Real servers are dedicated physical servers that are typically configured in groups called server farms. These servers provide services to clients, such as HTTP or XML content, streaming media (video or audio), TFTP or FTP services, and so on. When configuring real servers, you assign names to them and specify IP addresses, connection limits, and weight values.

The ACE appliance uses traffic classification maps (class maps) within policy maps to filter specified traffic and to apply specific actions to that traffic based on the load-balancing configuration. A load-balancing predictor algorithm (round-robin or least connections) determines the servers to which the ACE appliance sends connection requests. For information about configuring class maps, see Configuring Virtual Context Class Maps, page 10-8.

By default, real servers with multiple probes configured for them have an OR logic associated with them. This means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state.

Click this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic).

The Fail-On-All function is applicable to all probe types.

Min. Connections

Enter the minimum number of connections to be allowed on this server before the ACE appliance starts sending connections again after it has exceeded the Max. Connections limit. This value must be less than or equal to the Max. Connections value. By default, this value is equal to the Max. Connections value. Valid entries are integers from 1 to 4000000.

Max. Connections

Enter the maximum number of active connections allowed on this server. When the number of connections exceeds this value, the ACE appliance stops sending connections to this server until the number of connections falls below the Min. Connections value. Valid entries are integers from 1 to 4000000, and the default is 4000000.

Weight

This field appears only for real servers identified as hosts.

Enter the weight to be assigned to this real server in a server farm. Valid entries are integers from 1 to 100, and the default is 8.

Probes

This field appears only for real servers identified as hosts.

In the Probes field, select the probes that are to be used for health monitoring in the list on the left, then click Add. The selected probes appear in the list on the right.

To remove probes that you do not want to use for health monitoring, select them in the list on the right, then click Remove. The selected probes appear in the list on the left.

Web Host Redirection

URL string used to redirect requests to another server. This field appears only for real servers identified as redirect servers. Enter the URL and port used to redirect requests to another server.

Valid entries are in the form http://host.com:port where host is the name of the server and port is the port to be used. Valid host entries are unquoted text strings with no spaces and a maximum of 255 characters. Valid port numbers are from 1 to 65535.

The relocation string supports the following special characters:

•%h—Inserts the hostname from the request Host header

•%p—Inserts the URL path string from the request

Redirection Code

This field appears only for real servers identified as redirect servers.

Select the appropriate redirection code:

•N/A—Indicates that the webhost redirection code is not defined.

•301—Indicates that the requested resource has been moved permanently. For future references to this resource, the client should use one of the returned URIs.

•302—Indicates that the requested resource has been found, but has been moved temporarily to another location. For future references to this resource, the client should use the request URI because the resource may be moved to other locations from time to time.

Rate Bandwidth

The bandwidth rate is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions.

Specify the real server bandwidth limit in bytes per second. Valid entries are integers from 1 to 300000000.

Rate Connection

The connection rate is the number of connections per second received by the ACE and applies only to new connections destined to a real server.

Specify the limit for connections per second. Valid entries are integers from 1 to 350000.

Step 4 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit the procedure without saving your entries and to return to the Real Servers table.

In the table, Disabled indicates that either the information is not available from the database or that it is not being collected via SNMP. To identify any SNMP-related issues, select the real server's virtual context in the object selector. If there are problems with SNMP, SNMP status will appear in the upper right above the content pane.

In the table, Disabled indicates that either the information is not available from the database or that it is not being collected via SNMP. To identify any SNMP-related issues, select the real server's virtual context in the object selector. If there are problems with SNMP, SNMP status will appear in the upper right above the content pane.

Table 4-2 Real Server Operational States

State

Description

ARP Failed

An ARP request to this server has failed.

Failed

The server has failed and will not be retried for the amount of time specified by its retry timer.

Inactive

The server is disabled as it has become inactive such as in the case when the real server is not associated to any server farm.

Inband probe failed

The server has failed the inband Health Probe agent.

In service

The server is in use as a destination for server load balancing client connections.

Max. Load

The server is under maximum load and cannot receive any additional connections.

Operation wait

The server is ready to become operational but is waiting for the associated redirect virtual server to be in service.

Out of service

The server is not in use by a server load balancer as a destination for client connections.

Probe failed

The server load-balancing probe to this server has failed. No new connections will be assigned to this server until a probe to this server succeeds.

Probe testing

The server has received a test probe from the server load balancer.

Ready to test

The server has failed and its retry timer has expired; test connections will begin flowing to it soon.

Return code failed

The server has been disabled because it returned an HTTP code that matched a configured value.

Standby

The server is in standby state. No connections will be assigned to it unless the primary server fails.

Test wait

The server is ready to be tested. This state is applicable only when the server is used for HTTP redirect load balancing.

Testing

The server has failed and has been given another test connection. The success of this connection is not known.

Throttle: DFP

DFP has lowered the weight of the server to throttle level; no new connections will be assigned to the server until DFP raises its weight.

Throttle: max clients

The server has reached its maximum number of allowed clients.

Throttle: max connections

The server has reached its maximum number of connections and is no longer being given connections.

Configuring Server Farms

Server farms are groups of networked real servers that contain the same content and that typically reside in the same physical location in a data center. Web sites often comprise groups of servers configured in a server farm. Load-balancing software distributes client requests for content or services among the real servers based on the configured policy and traffic classification, server availability and load, and other factors. If one server goes down, another server can take its place and continue to provide the same content to the clients who requested it.

Enter a brief description for this server farm. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.

Fail Action

Select the action the ACE appliance is to take with respect to connections if any real server in the server farm fails:

•N/A—Indicates that the ACE appliance is to take no action if any server in the server farm fails.

•Purge—Indicates that the ACE appliance is to remove connections to a real server if that real server in the server farm fails. The ACE appliance sends a reset command to both the client and the server that failed.

Fail-On-All

This field appears only for host server farms.

By default, real servers that you configure in a server farm inherit the probes that you configure directly on that server farm. When you configure multiple probes on a server farm, the real servers in the server farm use an OR logic with respect to the probes, which means that if one of the probes configured on the server farm fails, all the real servers in that server farm fail and enter the PROBE-FAILED state. With AND logic, if one server farm probe fails, the real servers in the server farm remain in the operational state. If all the probes associated with the server farm fail, then all the real servers in that server farm fail and enter the PROBE-FAILED state.

Click this checkbox to configure the real servers in a server farm to use AND logic with respect to multiple server farm probes.

The Fail-On-All function is applicable to all probe types.

Transparent

This field appears only for real servers identified as host servers.

Check the check box to specify that network address translation from the VIP address to the server IP is to occur. Clear the check box to indicates that network address translation from the VIP address to the server IP address is not to occur (default).

Partial-Threshold Percentage

This field appears only for host server farms.

Enter the minimum percentage of real servers in the primary server farm that must remain active for the server farm to stay up. If the percentage of active real servers falls below this threshold, the ACE takes the server farm out of service. Valid entries are integers from 0 to 99. The default is 0.

Back Inservice

This field appears only for host server farms.

Enter the percentage of real servers in the primary server farm that must be active again for the ACE to place the server farm back into service. Valid entries are integers from 0 to 99. The value in this field should be larger than the value in the Partial Threshold Percentage field. The default is 0.

Probes

This field appears only for real servers identified as host servers.

In the Probes field, select the probes that are to be used for health monitoring in the list on the left, then click Add. The selected probes appear in the list on the right.

To remove probes that you do not want to use for health monitoring, select them in the list on the right, then click Remove. The selected probes appear in the list on the left.

Step 4 Click:

•Deploy Now to deploy this configuration on the ACE appliance. To add real servers to the farm and to configure server farm attributes, see:

Adding Real Servers to a Server Farm

After adding a server farm, (seeConfiguring Server Farms), you can associate real servers with it and configure predictors and retcode maps. The configuration screens for these attributes appear beneath the Server Farms table or after you have successfully added a new server farm.

Note If you do not see these tabs beneath the Server Farms table, click the Switch between Configure and Browse Modes button.

When creating or editing a server farm, if the real server to be added has the same name as an existing global real server but contains a different IP address (or no IP address), the Device Manager displays the following error message:

Enter the port number to be used for server port address translation (PAT). Valid entries are integers from 0 to 65535. The default value is 0.

If you use the default value of 0, the ACE will not perform port translation and the original destination port from the client connection persists to the server connection. If you specify a value other than 0, the original destination port is ignored and all communication to the real server is initiated on the defined port.

Note If you specified the type of server farm as Redirect, leave the port number set to 0 for the redirect server farm.

Backup Server Name

Select the server that is to act as the backup server for the server farm. Leave this field blank to indicate that there is no designated backup server for the server farm.

Backup Server Port

If you select a backup server, enter the backup server port number. Valid entries are integers from 0 to 65535. The default value is 0.

If you use the default value of 0, the ACE will not perform port translation and the original destination port from the client connection persists to the server connection. If you specify a value other than 0, the original destination port is ignored and all communication to the real server is initiated on the defined port.

Note If you specified the type of server farm as Redirect, leave the port number set to 0 for the redirect server farm.

State

Select the state of this server:

•In Service—Indicates that this server is in service.

•In Service Standby—Indicates that this server is a backup server and is to remain inactive unless the primary server fails. If the primary server fails, the backup server becomes active and starts accepting connections.

•Out Of Service—Indicates that this server is out of service.

Fail-On-All

This field appears only for real servers identified as host servers.

By default, real servers with multiple probes configured for them have an OR logic associated with them. This means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state.

Click this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic).

The Fail On All function is applicable to all probe types.

Min. Connections

Enter the minimum number of connections that the number of connections must fall below before the ACE appliance resumes sending connections to the server after it has exceeded the number in the Max. Connections field. The number in this field must be less than or equal to the number in the Max. Connections field. 1 to 4000000. The default value is 4000000.

Max. Connections

Enter the maximum number of active connections that can be sent to the server. When the number of connections exceeds this number, the ACE appliance stops sending connections to the server until the number of connections falls below the number specified in the Min. Connections field. Valid entries are integers from 1 to 4000000. The default is 4000000.

Weight

Enter the weight to assign to the server. Valid entries are integers from 1 to 100, and the default is 8.

Cookie String

This field appears only for real servers identified as hosts.

Enter a cookie string value of the real server, which is to be used for HTTP cookie insertion when establishing a sticky connection. Valid entries are text strings with a maximum of 32 alphanumeric characters. You can include spaces and special characters in a cookie string value.

Use cookie insertion when you want to use a session cookie for persistence if the server is not currently setting the appropriate cookie. With this feature enabled, the ACE inserts the cookie in the Set-Cookie header of the response from the server to the client. See Chapter 5, "Configuring Stickiness" for details on HTTP cookie sticky connections.

Probes

Select the probes in the list on the left that you want to apply to this server, then click Add. The selected probes appear in the list on the right. To remove probes you do not want to apply to this server, select the probes in the list on the right, then click Remove.

Rate Bandwidth

The bandwidth rate is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions.

Specify the bandwidth limit in bytes per second. Valid entries are integers from 1 to 300000000.

Rate Connection

The connection rate is the number of connections per second received by the ACE and applies only to new connections destined to a real server.

Specify the limit for connections per second. Valid entries are integers from 1 to 350000.

Step 5 When you finish configuring this server for this server farm, click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the Real Servers table.

•Next to save your entries and to add another real server for this server farm.

Configuring the Predictor Method for Server Farms

After adding a server farm, (Configuring Server Farms), you can associate real servers with it and configure the predictor method and retcode maps. The configuration screens for these attributes appear beneath the Server Farms table or after you have successfully added a new server farm.

Note If you do not see these tabs beneath the Server Farms table, click the Switch between Configure and Browse Modes button.

Use this procedure to configure the predictor method for a server farm. The predictor method specifies how the ACE appliance is to select a server in the server farm when it receives a client request for a service.

Step 3 In the Type field, select the method that the ACE appliance is to use to select a server in this server farm when it receives a client request. Table 4-5 lists the available options and describes them.

The ACE selects the server using a hash value based on the source or destination IP address.

To configure the hash address predictor method:

1. In the Mask Type field, indicate whether server selection is based on source IP address or the destination IP address:

–N/A—This option is not defined.

–Destination—The server is selected based on the destination IP address.

–Source—The server is selected based on the source IP address.

2. In the IP Netmask field, select the subnet mask to apply to the address. If none is specified, the default is 255.255.255.255.

Hash Content

The ACE selects the server by using a hash value based on the specified content string of the HTTP packet body.

1. In the Begin Pattern field, enter the beginning pattern of the content string and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification.

Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 10-31lists the supported characters that you can use for matching string expressions.

2. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification.

Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 10-31lists the supported characters that you can use for matching string expressions.

3. In the Length field, enter the length in bytes of the portion of the content (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are integers from 1 to 1000 bytes.

The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000.

You cannot specify both the length and the end-pattern options for a Hash Content predictor.

4. In the HTTP Content Offset field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are integers from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content.

Hash Cookie

The ACE selects the server by using a hash value based on the cookie name.

In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters.

Hash Secondary Cookie

The ACE selects the server by using the hash value based on the specified cookie name in the URL query string, not the cookie header.

In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters.

Hash Header

The ACE selects the server by using a hash value based on the header name.

In the Header Name field, select the HTTP header to be used for server selection:

•To specify an HTTP header that is not one of the standard HTTP headers, select the first radio button and enter the HTTP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.

•To specify one of the standard HTTP headers, select the second radio button, then select one of the HTTP headers from the list.

Hash Layer4

The ACE selects the server by using a Layer 4 generic protocol load-balancing method. Use this predictor to load balance packets from protocols that are not explicitly supported by the ACE.

1. In the Begin Pattern field, enter the beginning pattern of the Layer 4 payload and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification.

Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 10-31lists the supported characters that you can use for matching string expressions.

2. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification.

Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 10-31lists the supported characters that you can use for matching string expressions.

3. In the Length field, enter the length in bytes of the portion of the payload (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are integers from 1 to 1000 bytes.

The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000.

You cannot specify both the length and end-pattern options for a Hash Layer 4 predictor.

4. In the HTTP Content Offset field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are integers from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content.

Hash URL

The ACE selects the server using a hash value based on the URL. Use this method to load balance firewalls.

Enter values in one or both of the pattern fields:

•In the URL Begin Pattern field, enter the beginning pattern of the URL and the pattern string to parse.

•In the URL End Pattern field, enter the ending pattern of the URL and the pattern string to parse.

Valid entries for these fields are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters for each pattern you configure.

Least Bandwidth

The ACE selects the server with the least amount of network traffic over a specified sampling period.

1. In the Assess Time field, enter the number of seconds for which the ACE is to collect traffic information. Valid entries are integers from 1 to 10 seconds.

2. In the Least Bandwidth Samples field, enter the number of samples over which you want to weight and average the results of the probe query to calculate the final load value. Valid entries are 1, 2, 4, 8, and 16 (integers from 1 to 16 that are also a power of 2).

Least Connections

The ACE selects the server with the fewest number of connections.

In the Slow Start Duration field, enter the slow-start value to be applied to this predictor method. Valid entries are integers from 1 to 65535, where 1 is the slowest ramp-up value.

The slow-start mechanism is used to avoid sending a high rate of new connections to servers that you have just put into service.

Least Loaded

The ACE selects the server with the lowest load based on information from SNMP probes.

1. In the SNMP Probe Name field, select the name of the SNMP probe to use.

2. In the Auto Adjust field, configure the autoadjust feature to assign a maximum load value of 16000 to that server to prevent it from being flooded with new incoming connections. The ACE periodically adjusts this load value based on feedback from the server's SNMP probe and other configured options. Options include:

–N/A—Indicates that this option is not defined.

–Average—Instructs the ACE to apply the average load of the server farm to a real server whose load reaches zero. The average load is the running average of the load values across all real servers in the server farm.

–Off—Overrides the default behavior of the ACE of setting the load value for a server with a load of zero to 16000. When you configure this parameter, the ACE sends all new connections to the server that has a load of zero until the next load update arrives from the SNMP probe for this server. There may be times when you want the ACE to send all new connections to a real server whose load is zero.

3. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Clear the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation.

To instruct the ACE to select the server with the lowest load, use the predictor least-loaded command in server farm host or redirect configuration mode. With this predictor, the ACE uses SNMP probes to query the real servers for load parameter values (for example, CPU utilization or memory utilization). This predictor is considered adaptive because the ACE continuously provides feedback to the load-balancing algorithm based on the behavior of the real server.

To use this predictor, you must associate an SNMP probe with it. The ACE queries user-specified OIDs periodically based on a configurable time interval. The ACE uses the retrieved SNMP load value to determine the server with the lowest load.

The syntax of this predictor command is as follows:

predictor least-loaded probename

The name argument specifies the identifier of the existing SNMP probe that you want the ACE to use to query the server. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.

For example, to configure the ACE to select the real server with the lowest load based on feedback from an SNMP probe called PROBE_SNMP, enter:

host1/Admin(config)#serverfarm SF1

host1/Admin(config-sfarm-host)#predictor least-loaded probePROBE_SNMP

host1/Admin(config-sfarm-host-predictor)#

To reset the predictor method to the default of Round Robin, enter:

host1/Admin(config-sfarm-host)#no predictor

Response

The ACE selects the server with the lowest response time for a requested response-time measurement.

1. In the Response Type field, select the type of measurement to use:

–App-Req-To-Resp—The response time from when the ACE sends an HTTP request to a server to the time that the ACE receives a response from the server for that request.

–Syn-To-Close—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a CLOSE from the server.

–Syn-To-Synack—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a SYN-ACK from the server.

2. In the Response Samples field, enter the number of samples over which you want to average the results of the response-time measurement. Valid entries are 1, 2, 4, 8, and 16 (integers from 1 to 16 that are also a power of 2).

3. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Clear the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation.

Round Robin

The ACE selects the next server in the list of servers based on server weight. This is the default predictor method.

Step 5 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the t Connection field table.

Configuring Server Farm HTTP Return Error-Code Checking

After adding a server farm, (Configuring Server Farms), you can associate real servers with it and configure the predictor method and retcode maps. The configuration screens for these attributes appear beneath the Server Farms table or after you have successfully added a new server farm.

Use this procedure to configure HTTP return error-code checking (retcode map) for a server farm.

Note This feature is available only for server farms configured as hosts. It is not available for server farms configured with the type Redirect.

Step 2 Select the server farm you want to configure return error-code checking for, then select the Retcode Map tab. The Retcode Map table appears. If you do not see tabs beneath the Server Farms table, click the Switch Between Configure And Browse Modes button.

Step 3 Click Add to add a new entry to the table. The Retcode Map configuration screen appears.

Note You cannot modify an entry in the Retcode Map table. Instead, delete the existing entry, then add a new one.

Step 4 In the Lowest Retcode field, enter the minimum value for an HTTP return error code. Valid entries are integers from 100 to 599. This number must be less than or equal to the number in the Highest Retcode field.

Step 5 In the Highest Retcode field, enter the maximum number for an HTTP return error code. Valid entries are integers from 100 to 599. This number must be greater than or equal to the number in the Lowest Retcode field.

Step 6 In the Type field, specify the action to be taken and related options using the information in Table 4-6.

Table 4-6 Return-Code Type Configuration Options

Option

Description

Count

The ACE tracks the total number of return codes received for each return code number that you specify.

Log

The ACE generates a syslog error message when the number of events reaches a specified threshold.

1. In the Threshold field, enter the number of events that the ACE is to receive before generating a syslog error message. Valid entries are integers from 1 to 4294967295.

2. In the Reset field, enter the time interval in seconds for which the ACE checks for the return code. Valid entries are integers from 1 to 4294967295 seconds.

Remove

The ACE generates a syslog error message when the number of events reaches a specified threshold and then removes the server from service.

1. In the Threshold field, enter the number of events that the ACE is to receive before generating a syslog error message and removing the server from service. Valid entries are integers from 1 to 4294967295.

2. In the Reset field, enter the time interval in seconds for which the ACE checks for the return code. Valid entries are integers from 1 to 4294967295 seconds.

3. In the Resume Service field, enter the number of seconds that the ACE waits before it resumes service for the real server automatically after taking the real server out of service. Valid entries are 30 to 3600 seconds with a default of 300 seconds.

Step 7 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the Retcode Map table.

Configuring Health Monitoring

You can instruct the ACE appliance to check the health of servers and server farms by configuring health probes (sometimes referred to as keepalives). After you create a probe, you assign it to a real server or a server farm. A probe can be one of many types, including TCP, ICMP, Telnet, HTTP, and so on. You can also configure scripted probes using the TCL scripting language (see TCL Scripts).

The ACE appliance sends out probes periodically to determine the status of a server, verifies the server response, and checks for other network problems that may prevent a client from reaching a server. Based on the server response, the ACE appliance can place the server in or out of service, and, based on the status of the servers in the server farm, can make reliable load-balancing decisions.

Health monitoring on the ACE appliance tracks the state of a server by sending out probes. Also referred to as out-of-band health monitoring, the ACE appliance verifies the server response or checks for any network problems that can prevent a client to reach a server. Based on the server response, the ACE appliance can place the server in or out of service, and can make reliable load balancing decisions.

The ACE appliance identifies the health of a server in the following categories:

•Passed—The server returns a valid response.

•Failed—The server fails to provide a valid response to the ACE appliance is unable to reach a server for a specified number of retries.

By configuring the ACE appliance for health monitoring, the ACE appliance sends active probes periodically to determine the server state.

The ACE appliance supports 4000 unique probe configurations which includes ICMP, TCP, HTTP, and other predefined health probes. The ACE appliance also allows the opening of 1000 sockets simultaneously.

TCL Scripts

The ACE appliance supports several specific types of health probes (for example HTTP, TCP, or ICMP health probes) when you need to use a diverse set of applications and health probes to administer your network. The basic health probe types supported in the current ACE appliance software release may not support the specific probing behavior that your network requires. To support a more flexible health-probing functionality, the ACE appliance allows you to upload and execute TCL scripts on the ACE appliance.

The TCL interpreter code in the ACE appliance is based on Release 8.44 of the standard TCL distribution. You can create a script to configure health probes. Script probes operate similar to other health probes available in the ACE appliance software. As part of a script probe, the ACE appliance executes the script periodically, and the exit code that is returned by the executing script indicates the relative health and availability of specific real servers. For information on health probes, see Configuring Health Monitoring for Real Servers.

For your convenience, the following sample scripts for the ACE appliance are available to support the TCL feature and are supported by Cisco TAC:

•CHECKPORT_STD_SCRIPT

•ECHO_PROBE_SCRIPT

•FINGER_PROBE_SCRIPT

•FTP_PROBE_SCRIPT

•HTTP_PROBE_SCRIPT

•HTTPCONTENT_PROBE

•HTTPHEADER_PROBE

•HTTPPROXY_PROBE

•IMAP_PROBE

•LDAP_PROBE

•MAIL_PROBE

•POP3_PROBE

•PROBENOTICE_PROBE

•RTSP_PROBE

•SSL_PROBE_SCRIPT

•TFTP_PROBE

These scripts are located in the probe: directory and are accessible in both the Admin and user contexts. Note that the script files in the probe: directory are read-only, so you cannot copy or modify them. However, you can copy files from the probe: directory. For more information, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.

To load a script into memory on the ACE appliance and enable it for use, use the script file command. For detailed information on uploading and executing Toolkit Command Language (TCL) scripts on the ACE appliance, refer to the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide.

Configuring Health Monitoring for Real Servers

To check the health and availability of a real server, the ACE appliance periodically sends a probe to the real server. Depending on the server response, the ACE appliance determines whether to include the server in its load-balancing decision.

Use this procedure to establish monitoring of real servers to determine their viability in load-balancing decisions.

Step 3 In the Name field, enter a name that identifies the probe and that associates the probe with the real server. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.

Step 4 In the Type field, select the type of probe you want to use. The probe type determines what the probe sends to the real server. See Table 4-7 for the types of probes and their descriptions.

Table 4-7 Probe Types

Probe Type

Description

DNS

Sends a request to a DNS server giving it a configured domain. To determine if the server is up, the ACE appliance must receive the configured IP address for that domain.

ECHO-TCP

Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE appliance retries as configured before the server is marked as failed.

ECHO-UDP

Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE appliance retries as configured before the server is marked as failed.

FINGER

Sends a probe to the server to verify that a defined username is a username on the server.

FTP

Initiates an FTP session. By default, this probe is for an anonymous login with the option of configuring a user ID and password. The ACE appliance performs an FTP GET or LS to determine the outcome of the problem. This probe supports only active connections.

HTTP

Sets up a TCP connection and issues an HTTP request. Any valid HTTP response causes the probe to mark the real server as passed.

HTTPS

Similar to an HTTP probe, but this probe uses SSL to generate encrypted data.

ICMP

Sends an ICMP request and listens for a response. If the server returns a response, the ACE appliance marks the real server as passed. If there is no response and times out, or an ICMP standard error occurs, such as DESTINATION_UNREACHABLE, the ACE appliance marks the real server as failed.

IMAP

Initiates an IMAP session, using a configured user ID and password. Then, the probe attempts to retrieve e-mail from the server and validates the result of the probe based on the return codes received from the server.

POP

Initiates a POP session, using a configured user ID and password. Then, the probe attempts to retrieve e-mail from the server and validates the result of the probe based on the return codes received from the server.

RADIUS

Connects to a RADIUS server and logs into it to determine if the server is up.

RTSP

Establishes a TCP connection and sends a request packet to the server. The ACE compares the response with the configured response code to determine whether the probe succeeded.

Scripted

Executes probes from a configured script to perform health probing. This method allows you to author specific scripts with features not present in standard probes.

SIP-TCP

Establishes a TCP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed.

SIP-UDP

Establishes a UDP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed.

SMTP

Initiates an SMTP session by logging into the server.

SNMP

Establishes a UDP connection and sends a maximum of eight SMNP OID queries to probe the server. The ACE weighs and averages the load information that is retrieved and uses it as input to the least-loaded algorithm for load-balancing decisions. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed.

TCP

Initiates a TCP handshake and expects a response. By default, a successful response causes the probe to mark the server as passed. The probe then sends a FIN to end the session. If the response is not valid, or if there is no response, the probe marks the real server as failed.

TELNET

Establishes a connection to the real server and verifies that a greeting from the application was received.

UDP

Sends a UDP packet to a real server. The probe marks the server as failed only if an ICMP Port Unreachable messages is returned.

Note Click More Settings to access the additional general attributes for the selected probe type. By default, the Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-8 Health Monitoring General Attributes

Field

Action

Description

Enter a description for this probe. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.

Probe Interval (Seconds)

Enter the number of seconds that the ACE is to wait before sending another probe to a server marked as passed. Valid entries are from 2 to 65535 with a default of 15.

Pass Detect Interval (Seconds)

Enter the number of seconds that the ACE is to wait before sending another probe to a server marked as failed. Valid entries are integers from 2 to 65535 with a default of 60.

Fail Detect

Enter the consecutive number of times that an ACE must detect that probes have failed to contact a server before marking the server as failed. Valid entries are integers from 1 to 65535 with a default of 3.

More Settings

Pass Detect Count

Enter the number of successful probe responses from the server before the server is marked as passed. Valid entries are integers from 1 to 65535 with a default of 3.

Receive Timeout (Seconds)

Enter the number of seconds the ACE is to wait for a response from a server that has been probed before marking the server as failed. Valid entries are integers from 1 to 65535 with a default of 10.

By default, the probe uses the IP address from the real or virtual server configuration for the destination IP address. To override the destination address that the probe uses, enter the preferred destination IP address in this field using dotted-decimal notation, such as 192.168.11.1.

Check the check box to indicate that the destination IP address is routed according to the ACE internal routing table. Clear the check box to indicate that the destination IP address is not routed according to the ACE internal routing table.

1The Dest IP Address field is not applicable to the Scripted probe type.

2The Is Routed field is not applicable to the RTSP, Scripted, SIP-TCP, and SIP-UDP probe types.

DNS Probe Attributes

Note Click More Settings to access the additional attributes for the DNS probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-10 DNS Probe Attributes

Field

Action

Domain Name

Enter the domain name that the probe is to send to the DNS server. Valid entries are unquoted text strings with a maximum of 255 characters.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Echo-TCP Probe Attributes

Note Click More Settings to access the additional attributes for the Echo-TCP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-11 Echo-TCP Probe Attributes

Field

Action

Send Data

Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

More Settings

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

Echo-UDP Probe Attributes

Note Click More Settings to access the additional attributes for the Echo-UDP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-12 Echo-UDP Probe Attributes

Field

Action

Send Data

Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Finger Probe Attributes

Note Click More Settings to access the additional attributes for the Finger probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-13 Finger Probe Attributes

Field

Action

Send Data

Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

FTP Probe Attributes

Note Click More Settings to access the additional attributes for the FTP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-14 FTP Probe Attributes

Field

Action

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

HTTP Probe Attributes

Note Click More Settings to access the additional attributes for the HTTP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-15 HTTP Probe Attributes

Field

Action

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Request Method Type

Select the type of HTTP request method that is to be used for this probe:

•N/A—This option is not defined.

•Get—The HTTP request method is a GET with a URL of "/". This request method directs the server to get the page, and the ACE calculates a hash value for the content of the page. If the page content information changes, the hash value no longer matches the original hash value and the ACE assumes the service is down. This is the default request method.

•Head—The server is to only get the header for the page. Using this method can prevent the ACE from assuming that the service is down due to changed content and therefore changed hash values.

Request HTTP URL

This field appears if you select Head or Get in the Request Method Type field.

Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is "/'.

More Settings

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

User Name

Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Password

Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Reenter the password in the Confirm field.

Expect Regular Expression

Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.

Expect Regex Offset

Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Valid entries are integers from 1 to 4000.

Hash

Check the Hash check box to indicate that the ACE is to use an MD5 hash for an HTTP GET probe. Clear the Hash check box to indicate that the ACE should not use an MD5 hash for an HTTP GET probe.

Hash String

This field appears if the Hash check box is selected.

Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state.

Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters.

HTTPS Probe Attributes

Note Click More Settings to access the additional attributes for the HTTPS probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-16 HTTPS Probe Attributes

Field

Action

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Request Method Type

Select the type of HTTP request method that is to be used for this probe:

•N/A—This option is not defined.

•Get—The HTTP request method is a GET with a URL of "/". This request method directs the server to get the page, and the ACE calculates a hash value for the content of the page. If the page content information changes, the hash value no longer matches the original hash value and the ACE assumes the service is down. This is the default request method.

•Head—The server is to only get the header for the page. Using this method can prevent the ACE from assuming that the service is down due to changed content and therefore changed hash values.

Request HTTP URL

This field appears if you select Head or Get in the Request Method Type field.

Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is "/'.

Cipher

Select the cipher suite to be used with this HTTPS probe:

•RSA_ANY—The HTTPS probe accepts all RSA-configured cipher suites and that no specific suite is configured. This is the default action.

•RSA_EXPORT1024_WITH_DES_CBC_SHA

•RSA_EXPORT1024_WITH_RC4_56_MD5

•RSA_EXPORT1024_WITH_RC4_56_SHA

•RSA_EXPORT_WITH_DES40_CBC_SHA

•RSA_EXPORT_WITH_RC4_40_MD5

•RSA_WITH_3DES_EDE_CBC_SHA

•RSA_WITH_AES_128_CBC_SHA

•RSA_WITH_AES_256_CBC_SHA

•RSA_WITH_DES_CBC_SHA

•RSA_WITH_RC4_128_MD5

•RSA_WITH_RC4_128_SHA

SSL Version

Select the version of SSL or TLS to be used in ClientHello messages sent to the server:

•All—The probe is to use all SSL versions.

•SSLv3—The probe is to use SSL version 3.

•TLSv1—The probe is to use TLS version 1.

By default, the probe sends ClientHello messages with an SSL version 3 header and a TLS version 1 message.

More Settings

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

User Name

Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Password

Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Reenter the password in the Confirm field.

Expect Regular Expression

Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.

Expect Regex Offset

Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

Hash

Check the Hash check box to indicate that the ACE is to use an MD5 hash for an HTTP GET probe. Clear this check box to indicate that the ACE is not to use an MD5 hash for an HTTP GET probe.

Hash String

This field appears if the Hash check box is selected.

Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state.

Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters.

IMAP Probe Attributes

Note Click More Settings to access the additional attributes for the IMAP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-17 IMAP Probe Attributes

Field

Action

User Name

Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Password

Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Reenter the password in the Confirm field.

Mailbox Name

Enter the user mailbox name from which to retrieve e-mail for this IMAP probe. Valid entries are unquoted text strings with a maximum of 64 characters.

Request Command

Enter the request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

POP Probe Attributes

Note Click More Settings to access the additional attributes for the POP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-18 POP Probe Attributes

Field

Action

User Name

Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Password

Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Reenter the password in the Confirm field.

Request Command

Enter the request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

RADIUS Probe Attributes

Note Click More Settings to access the additional attributes for the RADIUS probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-19 RADIUS Probe Attributes

Field

Action

User Secret

Enter the shared secret to be used to allow probe access to the RADIUS server. Valid entries are case-sensitive strings with no spaces and a maximum of 64 characters.

User Name

Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Password

Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.

Reenter the password in the Confirm field.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

NAS IP Address

Enter the IP address of the Network Access Server (NAS) in dotted-decimal format, such as 192.168.11.1.

RTSP Probe Attributes

Note Click More Settings to access the additional attributes for the RTSP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-20 RTSP Probe Attributes

Field

Action

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

RTSP Require Header Value

Enter the Require header for this probe.

RTSP Proxy Require Header Value

Enter the Proxy-Require header for this probe.

RTSP Request Method Type

Select the request method type:

•N/A—No request method is selected.

•Describe—This probe is to use the Describe request type.

More Settings

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

Scripted Probe Attributes

Note Click More Settings to access the additional attributes for the Scripted probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-21 Scripted Probe Attributes

Field

Action

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Script Name

Enter the local name that you want to assign to this file on the ACE. This file can reside in the disk0: directory or the probe: directory (if the probe: directory exists).

Note The script file must first be established on the ACE device and the name must be entered exactly as is appears on the device. Please refer to your ACE documentation for more details.

Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

Script Arguments

Valid arguments are unquoted text strings with no spaces; separate multiple arguments with a space. The field limit is 255 characters.

More Settings

Script Needs To Be Copied From Remote Location?

Check this check box to indicate that the file needs to be copied from a remote server. Clear this check box to indicate that the script resides locally.

Protocol

This field appears if the script is to be copied from a remote server.

Select the protocol to be used for copying the script:

•FTP—The script is to be copied using FTP.

•TFTP—The script is to be copied using TFTP.

User Name

This field appears if FTP is selected in the Protocol field.

Enter the name of the user account on the remote server.

Password

This field appears if FTP is selected in the Protocol field.

Enter the password for the user account on the remote server.

Reenter the password in the Confirm field.

Source File Name

This field appears if the script is to be copied from a remote server.

Enter the host IP address, path, and filename of the file on the remote server in the format host-ip/path/filename where:

SIP-TCP Probe Attributes

Note Click More Settings to access the additional attributes for the SIP-TCP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-22 SIP-TCP Probe Attributes

Field

Action

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

Expect Regular Expression

Enter the expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device.

Expect Regex Offset

Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

SIP-UDP Probe Attributes

Note Click More Settings to access the additional attributes for the SIP-UDP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-23 SIP-UDP Probe Attributes

Field

Action

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Enable Rport

Check the check box to indicate that the server will be forced to send a reply from the same port on which the request was received. Clear the check box to indicate that the server can send the reply from a different port than the port from which the request was received.

Expect Regular Expression

Enter the expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device.

Expect Regex Offset

Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

SMTP Probe Attributes

Note Click More Settings to access the additional attributes for the SMTP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-24 SMTP Probe Attributes

Field

Action

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

SNMP Probe Attributes

Note Click More Settings to access the additional attributes for the SNMP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-25 SNMP Probe Attributes

Field

Action

SNMP Community

Enter the SNMP community string. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

TCP Probe Attributes

Note Click More Settings to access the additional attributes for the TCP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-26 TCP Probe Attributes

Field

Action

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Send Data

Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

More Settings

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

Expect Regular Expression

Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.

Expect Regex Offset

Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

Telnet Probe Attributes

Note Click More Settings to access the additional attributes for the Telnet probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-27 Telnet Probe Attributes

Field

Action

More Settings

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Is Connection

Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.

Open Timeout (Seconds)

Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

UDP Probe Attributes

Note Click More Settings to access the additional attributes for the UDP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 4-28 UDP Probe Attributes

Field

Action

Port

Enter the port number that the probe is to use. By default, the probe uses the port number based on its type.

Send Data

Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.

More Settings

Expect Regular Expression

Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.

Expect Regex Offset

Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

Configuring DNS Probe Expect Addresses

When a DNS probe sends a domain name resolve request to the server, it verifies the returned IP address by matching the received IP address with the configured addresses.

Use this procedure to specify the IP address that the ACE appliance expects to receive in response to a DNS request.

Note You cannot modify an entry in the Expect Addresses table. Instead, delete the existing entry, then add a new one.

Step 4 In the IP Address field, enter the IP address that the ACE appliance is to expect as a server response to a DNS request. Valid entries are unique IP addresses in dotted-decimal notation, such as 192.168.11.1.

Step 5 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entry and to return to the Expect Addresses table.

•Next to save your entry and to add another IP Address to the Expect Addresses table.

Step 4 In the Header Name field, select the HTTP header the probe is to use.

Step 5 In the Header Value field, enter the string to assign to the header field. Valid entries are text strings with a maximum of 255 characters. If the string includes spaces, enclose the string with quotes.

Step 6 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entry and to return to the Probe Headers table.

•Next to save your entry and to add another header entry to the Probe Headers table.

Configuring Health Monitoring Expect Status

When the ACE appliance receives a response from the server, it expects a status code to mark a server as passed. By default, there are no status codes configured on the ACE appliance. If you do not configure a status code, any response code from the server is marked as failed.

a. In the Min. Expect Status Code field, enter the expect status code for this probe. Valid entries are integers from 0 to 999.

b. In the Max. Expect Status code, enter the same expect status code that you entered in the Min. Expect Status Code field.

Step 5 To configure a range of expect status codes:

a. In the Min. Expect Status Code, enter the lower limit of the range of status codes. Valid entries are integers from 0 to 999.

b. In the Max. Expect Status Code, enter the upper limit of a range of status codes. Valid entries are integers from 0 to 999. The value in this field must be greater than or equal to the value in the Min. Expect Status Code field.

Step 6 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the Expect Status table.

•Next to save your entries and to add another expect status code to the Expect Status table.

Configuring an OID for SNMP Probes

When the ACE sends a probe with an SNMP OID query, the ACE uses the retrieved value as input to the least-loaded algorithm for load-balancing decisions. Least-loaded load balancing bases the server selection on the server with the lowest load value. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed.

Step 4 In the SNMP OID field, enter the OID that the probe is to use to query the server for a value. Valid entries are unquoted strings with a maximum of 255 alphanumeric characters in dotted-decimal notation, such as .1.3.6.1.4.2021.10.1.3.1. The OID string is based on the server type.

Step 5 In the Maximum Absolute Server Load Value field, enter the OID value in the form of an integer and to indicate that the retrieved OID value is an absolute value instead of a percent. Valid entries are integers from 1 to 4294967295.

When the ACE sends a probe with an SNMP OID query, the ACE uses the retrieved value as input to the least-loaded algorithm for load-balancing decisions. By default, the ACE assumes that the retrieved OID value is a percentile value. Use this option to specify that the retrieved OID value is an absolute value.

Step 6 In the Server Load Threshold Value field, specify the threshold at which the server is to be taken out of service:

•When the OID value is based on a percent, valid entries are integers from 1 to 100.

•When the OID is based on an absolute value, valid entries are from 1 to the value specified in the Maximum Absolute Server Load Value field.

Step 7 In the Server Load Weighting field, enter the weight to assign to this OID for the SNMP probe. Valid entries are integers from 0 to 16000.

Step 8 Click:

•Deploy Now to deploy this configuration.

•Cancel to exit this procedure without saving your entries and to return to the SNMP OID table.

•Next to deploy your entries and to add another item to the SNMP OID table.

Configuring Secure KAL-AP

A keepalive-appliance protocol (KAL-AP) on the ACE allows communication between the ACE and the Global Site Selector (GSS), which send KAL-AP requests, to report the server states and loads for global-server load-balancing (GSLB) decisions. The ACE uses KAL-AP through a UDP connection to calculate weights and provide information for server availability to the KAL-AP device. The ACE acts as a server and listens for KAL-AP requests. When KAL-AP is initialized on the ACE, the ACE listens on the standard 5002 port for any KAL-AP requests. You cannot configure any other port.

The ACE supports secure KAL-AP for MD5 encryption of data between it and the GSS. For encryption, you must configure a shared secret as a key for authentication between the GSS and the ACE context.

Use this procedure to configure secure KAL-AP associated with a virtual context.

Assumptions

•You have created a virtual context that specifies the Keepalive Appliance Protocol over UDP.

•You have enabled KAL-AP on the ACE by configuring a management class map and policy map, and apply it to the appropriate interface.

In the Hash Key field, enter the MD5 encryption method shared secret between the KAL-AP device and the ACE. Enter the shared secret as a case-sensitive string with no spaces and a maximum of 31 alphanumeric characters. The ACE supports the following special characters in a shared secret: